PreEmptive Protection Tackles Top Developer Compliance Complaints

May 7, 2019 983 Views Erica Kurfis

Developers cite compliance cost, complexity, and confusion as slowing innovation and impeding competitive goals. With the latest Dotfuscator and DashO releases, PreEmptive Protection dramatically improves developer productivity, automation, and scalability.

Seattle, WA. Microsoft Build Conference, May 7, 2019 - PreEmptive announced today the immediate availability of Dotfuscator Professional 4.41 and DashO 10.0 Beta. These updates to the PreEmptive Protection suite reduce initial protection configuration effort by 90% and offer complete automation of many of the most sophisticated runtime controls entirely. In a just-completed developer survey incorporating responses from over 315 organizations, 77% reported that “confusion around regulatory requirements slows innovation” while 71% stated that “the cost and complexity of compliance” is making it harder to compete.

Development organizations must find ways to meet complex privacy and compliance requirements even as they are under increasing pressure to deliver high quality, innovative features across platforms and devices.

“These releases demonstrate PreEmptive’s commitment to deliver powerful app and data security controls without unnecessary development overhead or an army of consultants.“ – Gabriel Torok, CEO PreEmptive

Dotfuscator Professional 4.41 offers an entirely new way of configuring and integrating Dotfuscator into automated build environments - installed on-demand, activated as part of the build, and run the same way as it is in development. The result is a 90%+ reduction in time and effort required to configure and integrate Dotfuscator into your preferred pipeline. “While these tools improve any CI build, they really shine with dynamic build agents - build agents that are provisioned on-demand - like in Azure Pipelines," said Nathan Arthur, Engineering VP, PreEmptive.

Dotfuscator 4.41 includes:

A NuGet package that can be deployed into a private artifact repository (e.g. Azure Artifacts) and dynamically installed via nuget install,
Dynamic licensing via a new "Floating" license model combined with flexible Dotfuscator activation options using command line arguments, environment variables, or MSBuild properties, and
A separately-released Azure Pipelines extension.

Another major innovation, Dotfuscator Visual Studio project file integration, further reduces time away from building new features and fixing bugs and supports all project types including Xamarin and early versions of Blazor and .NET Core 3.

“Taken together, these enhancements typically reduce configuration and implementation efforts by over 90%.” – William Leach, CTO, PreEmptive

DashO 10.0 Beta is the first application hardening solution to fully leverage R8, Google’s recently introduced Android app shrinker. R8 replaces ProGuard, an earlier shrinker and obfuscator. DashO 10.0 is currently in beta and is distributed with a Go Live license.

“DashO 10.0 takes a typical migration from ProGuard from hours to just a few minutes.” William Leach, CTO, PreEmptive

In addition to obfuscation transformation algorithms, DashO Android Mode also offers:

Tamper detection and defense,
Rooted device detection and response,
Anti-debugger controls,
Emulator detection and response, and
Anti-hooking controls.

Whether mobile, desktop or cloud, PreEmptive Protection’s powerful application and data protection controls can be implemented without any dependency on third-party APIs, changes to application source code or even a connection to a network.

“PreEmptive’s post-compile injection capabilities are also ideally suited to generate auditable logs and to meet specific offline requirements from organizations like the PCI Council and general guidelines from regulations like GDPR,” concluded Sebastian Holst, CSO, PreEmptive.

The Secret to Effective In-App Protection

Gartner calls In-App Protection “crucial” in their July 2019 Market Guide for In-App Protection In-App Protection. The guide’s summary advises security and risk management leaders to “take due care in protecting their application clients” in order to avoid “security failure.”

This raises the question – what constitutes “due care?” Obviously, no development organization looks to recklessly expose their applications or sensitive data to attack or compromise. On the other hand, over-engineered (or poorly engineered) security controls can quickly lead to excessive development costs, performance and quality issues, and, ultimately, unacceptable user experiences. While terms and terminology may vary, there is broad consensus on how to best define “due care” for any given application/user scenario.

If you don’t follow application security closely, you might think of application obfuscation and symbol renaming as being synonymous – and with good reason. Many platforms and languages, like .NET, Java, and JavaScript have popular obfuscators that do little else--our own Dotfuscator Community Edition for .NET and ProGuard for Java are good examples. However, obfuscation is far more than symbol renaming – and in-app protection is far more than obfuscation. Much of this expansion has been driven by new security requirements, shifting attack vectors, the rise of mobile and IoT computing and, lastly, the growing recognition inside regulations and legislation of the exposure that can result from inadequately protected software.

PreEmptive has partnered with Microsoft for 16 years and we’ve been involved with .NET since before version 1.0 shipped. From that perspective, it’s hard for us to pinpoint a time where the energy and enthusiasm in the .NET community has been higher than it is now. Over the past few years, Microsoft has put together the annual .NET Conf, completely online with viewers, participants, and local events all over the world. The event is virtual and streamed live over three days.

The big news at this year's .NET Conf was the launch of .NET Core 3, the next step in the continued evolution of .NET. .NET Core 3 is a huge effort, with many moving parts, and Microsoft announced many related releases to support it. Highlights for us included:

Search for lockpicking and you’ll see that there’s no shortage of suppliers ready to serve locksmiths and hobbyists, each community having a perfectly legitimate need. Is there any reason to believe that burglars don’t shop the same sites?

Hackers are developers and they have a long history of enthusiastically embracing and adapting development (and DevOps) innovations to speed their work, extend their reach, and ship software – the only difference is that they’re more likely to use those development tools and platforms on YOUR software rather than on their own. Static code analysis tools, debuggers, and even public bug tracking databases are all go-to hacker resources.

Can you tell the difference? Exception or the norm?

Of course, everyone is “for security” in principle. The hard question that each organization has to answer for themselves is “how much is enough?” Over-engineering is (by definition) excessive, and over-engineering application security can, in fact, be devastating as overly-complex algorithms, architectures and processes can compromise user experience, degrade performance and slow development velocity. On the other hand, punishment is swift for organizations that cut corners and do not effectively secure their applications, their data and, most importantly their users and business stakeholders. Finding and maintaining that balance can be time consuming and, because you can never be sure you’ve gotten it exactly right, it can also be a thankless job.

PreEmptive Protection Tackles Top Developer Compliance Complaints

Developers cite compliance cost, complexity, and confusion as slowing innovation and impeding competitive goals. With the latest Dotfuscator and DashO releases, PreEmptive Protection dramatically improves developer productivity, automation, and scalability.

The Secret to Effective In-App Protection

Symbol Renaming: App Security’s Maginot Line?

Highlights from .NET Conf 2019

Tools don’t hack apps, hackers do: Securing Android apps against Frida

Trusted Computing: Panacea or Magical Thinking?

Can you tell the difference? Exception or the norm?

Latest Blog Posts

The Secret to Effective In-App Protection

Symbol Renaming: App Security’s Maginot Line?

Highlights from .NET Conf 2019

Tools don’t hack apps, hackers do: Securing Android apps against Frida

Trusted Computing: Panacea or Magical Thinking?

Twitter